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DETAILED ACTION 
Claim Rejections - 35 USC § 101 

1. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims(s) 1 1-19 are rejected under 35 U.S.C. 101 because the claimed invention is directed to 
non-statutory subject matter. The claims lack the necessary physical articles or objects to 
constitute a machine or a manufacture within the meaning of 35 USC 101. They are clearly not a 
series of steps or acts to be a process nor are they a combination of chemical compounds to be a 
composition of matter. As such, they fail to fall within a statutory category. They are, at best, 
functional descriptive material per se. 



Claim 1, 10, 1 1 are rejected under 35 U.S.C. 101 because the claimed invention is directed to 
non-statutory subject matter. Claims(s) 1, 10, 11 are directed to a method and secure computer 
system were a request is received in a computer system, the entity (i.e. the user or the system) 
that made the request has a predetermined access level that is compared to a minimum access 
level that is established by the first base node; the entity is also checked to see if it completes a 
temporal access pattern, if the entity does complete a temporal access pattern, and the entity's 
predetermined access pattern is meets the minimum access level of the first base node, then the 
entity's request is granted. 

This claimed subject matter lacks a practical application -of a judicial exception (law of 
nature, abstract idea, naturally occurring phenomenon) since it fails to produce a useful, concrete 
and tangible result. 

Specifically, the claimed subject matter does not produce a tangible result because the 
claimed subject matter fails to produce a result that is limited to having real world value rather 
than a result that may be interpreted to be abstract in nature as, for example, a thought, a 
computation, or manipulated data. More specifically, the claimed subject matter provides for the 
granting of an entity's request if and only if, the entity doesn't complete a temporal access 
pattern, and the entity's predetermined access level meets the minimum access level of the first 
base node. This conditional statement yields only and tangible result if access is granted, but 
otherwise access isn't granted, this is what makes for a non-tangible result. This produced result 
remains in the abstract and, thus, fails to achieve the required status of having real world value. 
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Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

3. Claim(s) 1-9 & 10-19 are rejected under 35 U.S.C. 102(e) as being taught by 
Cotner (PGPub # US 2004/0044655 A1 ) hereinafter Cotner. 

Cotner teaches: 
Claim #1 

A method for secure access to a computer system, comprising the steps of: 

• receiving in said computer system a request from an entity with a predetermined 
access level for access to a first base node representing at least one of an 
information type and a computer system function (Paragraph: 0085), the 
examiner notes that the user or entity requests an update to the data in the 
database, this is equivalent to a computer system receiving a request and a first 
base node is of either a information type( i.e. data in data row) and a computer 
system function (i.e. the actual computer function that updates the row data in 
the row). 
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• determining if said access request completes a prohibited temporal access 
pattern for said entity(Paragraph: 0034), the examiner notes that by the fact that 
a user can or administrator can update the security label from Secret to Top 
Secret over a period of time based on the type of work or clearance that is 
needed to work on the project, it is inherent that this is a temporal access pattern. 

• and comparing a minimum access level established for said first base node to 
said predetermined access level(Paragraph: 0039), the examiner notes that the 
user security level must be greater or equal to the row's security level, this is 
equivalent to the first base node minimum access level doesn't exceed the 
predetermined access level of the user or entity. 

• and granting said access request only if it does not complete a prohibited 
temporal access pattern for said entity(Paragraph: 0034), the examiner notes 
that by the fact that a user can or administrator can update the security label from 
Secret to Top Secret over a period of time based on the type of work or 
clearance that is needed to work on the project, it is inherent that this is a 
temporal access pattern. 

• and said minimum access level for said first base node does not exceed said 
predetermined access level(Paragraph: 0039), the examiner notes that the user 
security level must be greater or equal to the row's security level, this is 
equivalent to the first base node minimum access level doesn't exceed the 
predetermined access level of the user or entity. 



Application/Control Number: 10/798,074 Page 5 

Art Unit: 2109 

The examiner further notes that claims 1 and 10 are duplicates and that claims 
10 is the implementation of claim 1 on the method, which when implement produces the 
same result. 

Claim #2 

The method according to claim 1 , further comprising the step of denying said 
request if said access request completes a prohibited temporal access pattern for said 
entity, (Paragraph: 0038 & 0039, the examiner notes that by the fact that a user or 
administrator can update the security label from Secret to Top Secret over a period of 
time based on the type of work or access clearance that is needed to work on the 
project, it is inherent that this is a completed temporal access pattern. 

The examiner further notes that claims 2 and 12 are duplicates and that claims 
12 is the implementation of claim 2 on the method, which when implement produces the 
same result. 

Claim # 3 

The method according to claim 1 , further comprising the step of denying said 
request if said minimum access level for said first base node exceeds said 
predetermined access level for said entity, (Paragraph: 0039, the examiner notes that 
the users security label is greater than or equal to the row's security label is the same 
as the entity or user meeting the minimum access level of the first base node. 
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The examiner further notes that claims 3 and 13 are duplicates and that claims 

13 is the implementation of claim 3 on the method, which when implement produces the 
same result. 

Claim #4 

The method according to claim 1, further comprising the steps of: logically 
organizing said computer system in the form of a tree hierarchy having a plurality of leaf 
nodes and higher-level nodes; defining a plurality of said base nodes as comprising 
respectively a plurality of leaf nodes of said tree hierarchy; and defining said higher- 
level nodes as aggregations of said base nodes, (Paragraphs: 0057, the examiner 
notes that the keywords "leaf node and higher level security level node" describes a tree 
hierarchy, which contains both higher level nodes and leaf nodes per se. 

The examiner further notes that claims 4 and 14 are duplicates and that claims 

14 is the implementation of claim 4 on the method, which when implement produces the 
same result. 

Claim #5 

The method according to claim 4 further comprising the step of identifying within 
said hierarchy any higher-level nodes that are aggregations comprising said first base 
node, (Paragraph: 0057 & Figure 4, the examiner notes that the rainbow (higher leaf 
node) is composed of a multitude of colors including sunset, which is the first base node 
in this case. 
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The examiner further notes that claims 5 and 15 are duplicates and that claims 

15 is the implementation of claim 5 on the method, which when implement produces the 
same result. 

Claim #6 

The method according to claim 5, further comprising the step of identifying within 
said hierarchy any nodes that comprise children of any generation of said high-level 
nodes that are aggregations comprising said first base node, (Paragraph: 0057 & 0058 
& Figure 4, the examiner notes that the rainbow (higher leaf node) is composed of a 
multitude of colors including sunset, which is the first base node in this case. 

The examiner further notes that claims 6 and 16 are duplicates and that claims 

16 is the implementation of claim 6 on the method, which when implement produces the 
same result. 

Claim #7 

The method according to claim 6, further comprising the step of updating a 
minimum required entity access level for any base nodes that comprise children of any 
generation of said higher-level nodes that are aggregations comprising said first base 
node, (Paragraph: 0058 & Figure 4 & 0085 & Figure 8A, the examiner notes that if the 
data is changed or updated in the row, for example the column headings are changed 
from secret to top secret, then the corresponding users (entity) security level is updated 
as well (i.e. sunset(first base node) to rainbow), then the user that initiated the update 
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will be able to access the top secret data at a rainbow security level or at a higher color 
access control level. 

The examiner further notes that claims 7 and 1 7 are duplicates and that claims 

17 is the implementation of claim 7 on the method, which when implement produces the 
same result. 

Claim #8 

The method according to claim 7, wherein said updating step further comprises 
the steps of: comparing said entity's predetermined access level against the minimum 
required access level of said higher-level nodes that are aggregations comprising said 
first base node; and updating a minimum required access level of any said base node 
that is also a member of any aggregation comprising said first base node if a minimum 
required access level for said higher-level node comprising said aggregation has a 
required access level that is higher than said entity's predetermined access level, 
(Paragraph: 0058 & Figure 4 & 0085 & Figure 8A, the examiner notes that if the data is 
changed or updated in the row, for example the column headings are changed from 
secret to top secret, then the corresponding users (entity) security level is updated as 
well (i.e. sunset(first base node) to rainbow), then the user that initiated the update will 
be able to access the top secret data at a rainbow security level or at a higher color 
access control level. 

The examiner further notes that claims 8 and 18 are duplicates and that claims 

18 is the implementation of claim 8 on the method, which when implement produces the 
same result. 
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Claim #9 

The method according to claim 1 , further comprising the steps of: comparing said 
entity's predetermined access level against the minimum required access level of at 
least one higher-level node that is an aggregation of base nodes including said first 
base node; and updating a minimum required access level of any said base node that is 
also a member of any aggregation comprising said first base node if a minimum 
required access level for said higher-level node comprising said aggregation has a 
required access level that is higher than said entity's predetermined access level, 
(Paragraph: 0058 & Figure 4 & 0085 & Figure 8A, the examiner notes that if the data is 
changed or updated in the row, for example the column headings are changed from 
secret to top secret, then the corresponding users(entity) security level is updated as 
well (i.e. sunset(first base node) to rainbow), then the user that initiated the update will 
be able to access the top secret data at a rainbow security level or at a higher color 
access control level. 

The examiner further notes that claims 9 and 19 are duplicates and that claims 
19 is the implementation of claim 9 on the method, which when implement produces the 
same result. 

Claim #11 

A secure computer system comprising: a plurality of logical base nodes 
representing at least one of an information type and a computer system function; a 
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plurality of higher-level nodes arranged together with said base nodes in the form of a 
tree hierarchy; a computer system interface capable of receiving a request from an 
entity with a predetermined access level for access to a first base node; a temporal 
access table; processing means programmed for comparing said access request to said 
temporal access table to determine if said access request completes a prohibited 
temporal access pattern for said entity, and for comparing a minimum access level 
established for said first base node to said predetermined access level and wherein said 
processing means grants said access requests only if it does not complete a prohibited 
temporal access pattern for said entity, and said minimum access level for said first 
base node does not exceed said predetermined access level, (Paragraphs: 0030 & 
0034, the examiner notes that a security table which relates a user identification and 
security table, change with time based on the project type and sensitivity level 
associated with the project, therefore it is inherent that a security table in fact is a 
temporal access table. The examiner further notes that to one of ordinary skill in the art, 
that a database is constructed in a software language and can only be implemented on 
a computer or computer system, thus it is inherent that a computer system and software 
will employ an interface for interaction with the user or administrator. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Dant B. Shaifer - Harriman whose telephone number is 
571-272-7910. The examiner can normally be reached on Monday - Thursday: 8:00am 
- 5:30pm Alt.Fridays off. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Joseph Del Sole can be reached on 571-272-1 130. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 




